What changed
OpenAI described a controlled autonomous pipeline that analyzed 2,308 candidate Linux-kernel findings, dynamically reproduced 1,724 vulnerabilities and produced 948 working local privilege-escalation exploits plus candidate patches for maintainer review. The run cost $1,213,430 in API credits.
Why it matters
Exploit reproduction can turn a large static-finding queue into evidence that maintainers can prioritize. The same scale also raises duplicate-reporting, disclosure and offensive-misuse risk, so revalidation against current code and coordinated human review are part of the result, not optional cleanup.
What to do
Kernel operators should prioritize current upstream and distribution patches rather than act on headline counts. Security teams evaluating similar systems should isolate targets, revalidate every candidate on the latest code, deduplicate against public fixes, require human disclosure review and retain exploit, patch and test provenance.
Caveat
This is OpenAI-authored research using an upcoming cyber model; the full finding set, pipeline and exploit corpus are not public while disclosure continues. Counts, cost and patch quality were not independently reproduced, and many findings were already patched, staged or under discussion by the time analysis finished.